ISAPI on IIS still sends Session_Id

[TobiS]

Hi we got a pentest on our unigui project. The only thing that is a problem is that the session_id is send in the custom header. So we like to remove it from there. i could manage to remove it from the local test ( .exe) but it still appears in the isapi version running on the iis server. 

Is there a way i can move it to the secure cookie? and if how. I guess even just removing it from the custom header would be enough. Removing it in the server module in the httpcommand event is to soon, since there is no session_id in it the moment it is called. Do you have a way to do it in unigui?

[TobiS]

nevermind i found a solution that works. Just in case someone is interested. i made a change in the uniguiisapi.pas.

in the "PrepareResponse" add

function StripHeaderLineAnsi(const sHeaders, sHeaderName: AnsiString): AnsiString;
var
  L, Line, NameLower: AnsiString;
  P, EOL: Integer;
begin
  Result := '';
  L := sHeaders;
  NameLower := AnsiLowerCase(sHeaderName);

  while L <> '' do
  begin
    // find end of line
    P := Pos(#13#10, L);
    if P = 0 then
    begin
      Line := L;
      L := '';
    end
    else
    begin
      Line := Copy(L, 1, P - 1);
      Delete(L, 1, P + 1); // remove line + CRLF
    end;

    // keep status line / empty lines / non-matching headers
    if (Pos(':', Line) = 0) then
    begin
      Result := Result + Line + #13#10;
      Continue;
    end;

    // compare header name (case-insensitive)
    if AnsiLowerCase(Copy(Line, 1, Pos(':', Line) - 1)) <> NameLower then
      Result := Result + Line + #13#10;
  end;
end;

than just before you write the header to the Response add 

ResultHeaders := PAnsiChar(StripHeaderLineAnsi(AnsiString(ResultHeaders), 'session_id'));

 

 

 

[delagoutte]

We also had a penetration test on our application developed with UniGUI. One of the findings concerned the session_id, which was returned in the first response header and then used in POST requests to /handleEvent with the _S_ID parameter, exposing the application to cross-site scripting (XSS) attacks. The company that conducted the audit recommends first using secure cookies, then implementing Cookie Prefixes and the SameSite attribute

 

Do you think this could be implemented by default in future versions of UniGUI, and in the meantime, do you think it is possible to implement it now, and if so, how?

[Farshad Mohajeri]

Hi,

Each unigui session should send the session id when making a request to the server. That's the only way server can recognize the session that is trying to communicate.

[delagoutte]

yes of course but you could do that with a secure cookies , no ?

[Farshad Mohajeri]

1 hour ago, delagoutte said:

yes of course but you could do that with a secure cookies , no ?

We will add this to our to-do list.